Robustness of quantum randomness expansion protocols in the presence of noise 
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In this paper we investigate properties of several randomness generation protocols in the device 
independent framework. Using Bell-type inequalities it is possible to certify that the numbers 
generated by an untrusted device are indeed random. We present a selection of certificates which 
guarantee two bits of randomness for each run of the experiment in the noiseless case and require 
the parties to share a maximally entangled state. To compare them we study their efficiency in the 
presence of white noise. We find that for different amounts of noise different operators are optimal 
for certifying most randomness. Therefore the vendor of the device should use different protocols 
depending on the amount of noise expected to occur. Another of our results that we find particularly 
interesting is that using a single Bell operator as a figure of merit is rarely optimal. 
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I. INTRODUCTION 

One of the most striking properties of quantum me- 
chanics is that it is intrinsically random. Moreover, if 
there exist only a slightly random processes, then also 
entirely free ones do [J ■ 

Random number generation is an important issue in 
computer science. Random numbers have many applica- 
tions in such topics as cryptography, authentication |3(, 
gambling and system modeling. 

Most of the random number generators (RNGs) are 
basing on purely algebraical manipulation on initial seed. 
Since the series of numbers produced by such genera- 
tors are created in a deterministic manner, these RNGs 
are called pseudo-random number generators (PRNGs) . 
There also exist RNGs basing on some chaotic classical 
physical processes such as electric or atmospheric noise 
or by estimating the entropy of hardware interrupts (for 
example in /dev/ random RNG on Linux systems). To 
make sure that given source of numbers is reliable, some 
statistical tests may be applied [4]. Still, these tests 
can never give a guarantee that the numbers were in- 
deed trustworthy, that is they cannot be predicted by an 
adversary. 

In this situation it is natural to try to use properties of 
quantum mechanics in order to generate entirely random 
sequences of numbers. There were efforts making use of 
such quantum processes like nuclear decay (for example 
HotBits [5] ) or photons hitting a semi-transparent mirror 
(for example id Quantique RNGs [(|). However when 
using one of the commercially available quantum random 
number generators (QRNGs) we still have to trust the 
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vendor of the device. 

Therefore many efforts have been made in the quantum 
information theory to attain a reliability while not trust- 
ing the device and even not knowing how does it work. 
Such an approach, introduced in [7(, is called device in- 
dependent. Instead of investigating the internal working 
of the device in some case it is sufficient to perform tests 
on its outputs. 

Recently the violation of certain Bell inequalities as 
a certificate of randomness for series from RNG has 
been used within the device independent approach [8rfl2j . 
These protocols were randomness expanders, as they use 
some initial amount randomness to obtain more more of 
it. In 8, 9] as a certificate of randomness the violation of 
the CHSH Bell inequality [l3[ was used, while in [l(| the 
GHZ correlations were used instead. 



A. Purpose of this paper 

Suppose there is a honest vendor that wants to produce 
and sell QRNGs. His problem is the lack of trust among 
his potential customers. Since he does not wants to cheat 
his clients, he can make the design of his device open. 
But still some parties may distrust that the device is 
construed in declared manner. 

The laws of quantum mechanics give him a way to con- 
vince his customers, that they do not need to know the 
internal working of the device to be sure that they get 
secure randomness. Using some form of Bell inequalities, 
they may check, after some statistical tests, that the de- 
vice produces certain amount of randomness, regardless 
of the way it has been constructed. Therefore, our honest 
vendor can propose that his costumers use the protocol 
described in [9j. However, he still needs to decide which 
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Bell inequality to use as a certificate This device will 
consist of three parts: two measurement apparatuses and 
a source of entangled states. The vendor's technology 
limits the quality (purity) of the states that his source 
can produce. Let's assume that they are Werner states 
Pw = P'\ip~) + that is singlets with admix- 

ture of white noise. The question that we try to answer in 
this paper is: Which certificate allows to guarantee most 
randomness for the given quality of the source measured 
by pi Using it will allow our vendor to maximally exploit 
the source he has. 

All Bell inequalities considered in this paper are maxi- 
mally violated with pure singlet states. In the noisy case 
values attainable by Bell operators^ are multiplied by p. 

In this paper we first make a short inspection of min- 
cntropy and Bell inequalities. Then we present 6 oper- 
ators, that in noiseless situation may certify two bits of 
randomness. 3 of them are based on known Bell inequal- 
ities, Braunstein-Caves family )14| . CHSH [13( and T3 
12]. After that we describe a method we used to find 
other certificates. Then we give 3 most interesting exam- 
ples found this way. Using semi-definite programming we 
compare the robustness of presented certificates. Finally 
we investigate the potential of using CHSH inequality to 
improve presented protocols. 



B. Min— entropy 

One of commonly used measures of randomness is min- 
entropy [IH , denoted . For given discrete probability 
distribution P = p\ , . . . , p n it is defined as 

H^iP) = - log 2 (nmx( K )) (I.l) 

Note that min-entropy is directly related to the guess- 
ing probability of the value of a particular variable with 
distribution P with strategy when one guesses the most 
probable result. In the context of guessing cryptographic 
keys, min-entropy is a measure of the difficulty of guess- 
ing the easiest single key in a given distribution of keys 
i. 

Having some string of characters from a source with 
given min-entropy per character it is possible to ex- 
tract it's randomness, that is create a shorter string with 
higher min-entropy per character [16l - ll8l ]. We use min- 
entropy as the measure of the efficiency of the protocol 
throughout the paper. 



1 The choice of the certificate is his only choice. Therefore, in 
the whole paper we identify a certificate with a protocol and use 
these two terms interchangeably 

2 We are assuming that Bell operators are linear functions of corre- 
lations, which is more strict that general case where Bell operator 
is a linear combination of probabilities. All Bell operators used 
in this paper meet this condition. 



II. RANDOMNESS CERTIFICATION 
PROTOCOLS 

In this paper we investigate the applicability for ran- 
domness certification of selected Bell operators, described 
below. Since we are working in device independent sce- 
nario, it is worth to notice that we have no insight into 
the workings of the device. We do not know what how 
Alice's and Bob's measurements are carried out, which 
results may even have outcomes predetermined by the 
constructor of the apparatus. The only thing we have 
access to, are outcomes that Alice and Bob get. 

We assume that Alice's and Bob's devices are sepa- 
rated during the measurements. This assumption is es- 
sential, since only in this case the violation of Bell in- 
equality has any meaning^. The separation may be for 
example space-like, if we assume that the signal may not 
travel between Alice's and Bob's part before the results 
are collected. 

If we want the randomness not only to be fair (for 
example for gambling and system modeling purposes), 
but also to be confidential (for example for cryptogra- 
phy or authentication), we also have to assume that the 
untrusted device do not communicate with the world out- 
side. Without this assumption even the fair RNG may 
send the results to the adversary. 

We will measure the randomness of a given pair of 
settings using min-entropy. For each pair (a, b) of choices 
of Alice's and Bob's measurement settings, there exist 
a distribution P(A, B\a,b) of pairs of outcomes. Min- 
entropy of the pair of (a, b) is the min-entropy of the 
distribution P(A, B\a, b). 

In the following we assume that all measurements give 
results +1 or — 1. 

We denote by A + ,A^ Alice's projector on results +1 
and —1 respectively, and similarly B + , B- for Bob. Since 
outcomes are binary we have A + + A- = 1, and the 
same for Bob's projectors. Then C(a, b) = 4- A+B+ — 2 ■ 
A + — 2 • B + + 1 is the correlation operator. We denote 
by Cor(a, b) = P{A = 1, B = l|a, b) + P{A = -1, B = 
-l\a,b)-P(A= 1,B= -l\a,b)-P{A = -l,B = l\a,b) 
the correlations between the binary results obtained by 
Alice when she chooses measurement a with Bob's results 
with measurement settings set to b. If p is the state 
describing the whole device (including Alice's and Bob's 
parts, which may be entangled), then Tr (pC(a,b)) = 
Cor(a, b) and Cor(a, b) may be estimated by collecting 
statistics of subsequent measurement results. 

The measurement settings and the device have to be 
independent. One of the ways to assure that is to choose 
these settings randomly. Since in such a situation ini- 
tial randomness is needed, protocols described below are 
randomness expanders. 



In fact this is a way to assert in the device independent sce- 
nario that Alice's and Bob's measurements may be treated alge- 
braically as commuting. 
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From theoretical point of view it is important to men- 
tion the possibility, that from fundamental point of view 
both measurement choices and results are predetermined. 
This loophole in Bell inequalities is called superdetermin- 
ism and makes all efforts towards generation of random- 
ness pointless. 

Below we present 6 different randomness certification 
protocols. First of them is based on a well known 
Braunsein-Caves Bell inequalities. Second one makes 
use of a pair of Bell operators, which are a decompo- 
sition of CHSH inequality. Third one consists of three 
Bell inequalities, with two of them being CHSH. Three 
remaining protocols make use of other Bell inequalities 
described below. 



A. Braunstein— Caves inequalities 

In [3] a family of chained Bell inequalities was intro- 
duced. The general formula for n th Braunstein-Caves 
operator is 

BC n = £7(1, 1) + £7(1, 2) + £7(2, 2) + £7(2, 3) + £7(3, 3) 
+ £7(3, 4) + . . . + £7(n - 1, n - 1) + £7(n - 1, n) 
+ £7(n, n) - £7(n, 1) 

(HI) 

The maximal value obtainable in quantum mechanics 
for n th Braunstein-Caves inequality is 2 • n ■ cos (j^) ■ In 
particular 

BC 3 = £7(1, 1)+£7(1, 2)+£7(2, 2)+£7(2, 3)+£7(3, 3)-£7(3, 1) 

(II.2) 

is limited by 5.19. 

If we consider the source's quality measured by p, then 
the maximal value is multiplied by p. 

We check the min-entropy guarantied by the violation 
of Braunstein-Caves inequality for the following three 
cases: 

• for n = 3 for the min-entropy of 1 st setting for Alice 
and 3 rd setting for BotQ, 

• for n = 5 of settings (1, 4jJ 

• for n = 7 of settings (1, 5). 

B. E Q and E 1 

In this case instead of taking only a single operator 
corresponding to some Bell inequality, we use more than 
one for randomness certification. 



4 Similar results would be obtained for these pairs of settings: (2, 1) 
and (3, 2). 

5 Similar results are for pairs (2,5), (3, 1), (4,2) and (5,3). 



Single CHSH operator may be decomposed into other 
Bell operators. Let us consider the following two opera- 
tors: 

E = £7(1,1) + £7(1, 2) (II.3a) 
Ex = £7(2, 1) - £7(2, 2) (II.3b) 

From Uffink's inequality [l9[ it follows that the max- 
imal values of III. 31 lie on a circle of radius 2. Taking 
into account symmetries of these operators, their maxi- 
mal values obtainable in quantum mechanics may be pa- 
rameterized in the following manner: 

Eo,max(<f>) = 2 • cos(0) (II.4a) 
E hmax (<t>) = 2 • sm((j>) (II.4b) 

with <j> e [0, 5] • The classical limit for the sum of values 
of these operators is 2. Thus for e {0, -|} classical and 
quantum limits are equal. 

Similarly like for previously described Bell operators, 
if the noise p occurs, then the values in III. 41 have to be 
multiplied by this value. In such cases the quantum limit 
of the sum of 111.31 may be achieved for a wider range of 
values of 0. 

Later in this paper we will examine the min-entropy 
for measurement settings pair (2, 1) as a function of <j> for 
maximal values of the operators III. 31 for different values 
of noise. Then we will find the optimal angle ^ as a 
function of noise. 

Let us note that this protocolcertificate requires both 
Alice's and Bob's parts of the device to have only 2 possi- 
ble measurement settings. It is the smallest requirements 
among all presented protocols. 

C. Ts with an additional condition 

Let us consider a scenario in which Alice has 4 pos- 
sible measurement settings and Bob has 3, each having 
2 possible outcomes. In [12| the following Bell operator 
was used: 

T 3 = £7(1, 1) + £7(2, 1) + £7(3, 1) + £7(4, 1) 

+ £7(1, 2) + £7(2, 2) - £7(3, 2) - £7(4, 2) (II.5) 
+ £7(1, 3) - £7(2, 3) + £7(3, 3) - £7(4, 3) 

Now let us take two additional Bell operators, which 
are identical to CHSH with certain choices of settings: 

CHSH! = £7(1, 1) + £7(3, 1) + £7(1, 2) - £7(3, 2) (II.6a) 
CHSH 2 = £7(2, 1) + £7(4, 1) + £7(2, 2) - £7(4, 2) (II.6b) 

The maximal value of III. 51 that may be obtained in 
quantum mechanics is 4 • « 5.928, and for III. 61 is 
2 • V2 « 2.82. 

If we impose on the device a condition that both opera- 
tors QT6] achieve the value of at least < £7 < 2 • -\/2, then 
the maximal value of III. 51 is a function of £7, T^^ max = 
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T3,max(C). We require the device to obtain this maximal 
value. In the case when we cope with noise or imperfec- 
tions of the device, where < p < 1, then we have to 
multiply all III. 51 and III. 61 by p. 

Assuming these conditions we will check the lower 
bound on the min-entropy, as a function of C with max- 
imal possible value of lII.5| for Alice's setting 1 and Bob's 
3. 



D. Certificates obtained randomly 

The three previous cases were chosen by us because 
they rely, at least to some extent on known Bell inequali- 
ties. In order to learn more about Bell operators certify- 
ing randomness we have used some randomized method 
of finding them. 

Most of the known interesting operators are in form 

where a € { — 1,0, 1}, i enumerates Alice's settings, and 
j Bob's settings. 

We have considered operators that have this form with 
4 settings for Alice and 3 settings for Bob. In this case 
there is around half a million different operators and we 
have randomly chosen a representative sample of around 
25 thousand for further studies. Then, for each choice we 
have computed min-entropy with noise parameter p = 
0.95 using semi-definite programming (which method is 
described in more details in section lPVl with results). The 
histogram presenting the number of operators that certify 
given randomness is shown in table HI 



min-entropy 
Bell inequalities 


0-0.05 
12853 


0.05-0.1 

689 


0.1-0.15 
722 


0.15-0.2 
696 


min-entropy 
Bell inequalities 


0.2-0.25 
939 


0.25-0.3 
907 


0.3-0.35 
850 


0.35-0.4 
1324 


min-entropy 
Bell inequalities 


0.4-0.45 
1176 


0.45-0.5 
839 


0.5-0.55 
1062 


0.55-0.6 
678 


min-entropy 
Bell inequalities 


0.6-0.65 
493 


0.65-0.7 
155 


0.7-0.75 
91 


0.75-0.8 
15 



TABLE I. Number of Bell inequalities that have been ran- 
domly chosen depending on the min-entropy they certify un- 
der noise p = 0.95. 

The most interesting operators are these, which certify 
the most randomness. 

Among tested operators 41 certified more than 0.72 
bits of randomness under high noise. These operators 
form 4 distinct groups that have identical maximal value 
and randomness certification properties. First of these 
groups (with 9 drawn instances) of them revealed to 



be isomorphic^ to BC3 described in III Al The remain- 
ing three groups are described in HID II (with 6 instances 
drawn) and III D~2l (with 15 and 11 instances drawn, re- 
spectively). 

1. Modified CHSH 

Now let us consider the following Bell operator which 
is similar to one used in (131 • We call in modified CHSH 
because it is a CHSH operator with one additional cor- 
relation function. 

Let us take operator of the following form: 

C(l, 2) + (7(1, 3) + (7(2, 1) + (7(2, 2) - (7(2, 3) (II.8) 

Under quantum mechanics its value is limited to l+2-\/2. 
First four terms form a CHSH operator. 

The protocol requires the device to reach the maximal 
value of this operator (multiplied by p in case with noise) . 

Further in the paper we will examine the min-entropy 
with pair of settings (1, 1). 

2. Other inequalities 

Let us consider the following Bell inequalities: 

h = <7(1, 2) - (7(1, 3) - (7(2, 1) - (7(2, 2) 

+(7(3,1) + (7(3, 3) + (7(4,1) (n9) 

< 1 + 6-cosQ) w6.19 

and 

h = -C(l, 2) + (7(1, 3) + (7(2, 1) + (7(2, 2) + (7(2, 3) 
+(7(3, 2) - (7(3, 3) + (7(4, 1) + (7(4, 2) + (7(4, 3) 

< 2 + 4- V2« 7.66 
(11.10) 

These two were taken as examples from wider groups 
of inequalities, that uses 4 measurement settings of Al- 
ice and 3 of Bob, and consist of 7, respectively 10, cor- 
relations. Inequalities in both of these groups have the 
same efficiency in generating min-entropy with noise. In- 
equalities form the first group are similar to these from 
Braunstein-Caves family. The pair of measurement set- 
tings for which the min-entropy will be investigated is 
(1,1)- 

The same as in protocols based on Braunstein-Caves 
inequalies A|) and modified CHSH piD 1|) . random 
number generation protocols using these inequalities re- 
quire the device to reach the maximal value of appropri- 
ate operator (multiplied by p in case of noise) . 



Up to two operations. First is a reordering of measurement set- 
tings, and second is a change of signs of results for one setting of 
one party. 
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III. IMPROVING CERTIFICATES WITH THE 
CHSH INEQUALITY 

Although CHSH inequality is not able to certify two 
bits of randomness even for p = 1, it is quite efficient for 
p < 0.9. In fact in this case it is able to guarantee more 
randomness than most of the two bit protocols, as it is 
shown in the table HU 



p 


global 


local 


0.99999 


1.21757 


0.99090 


0.999 


1.12231 


0.91155 


0.95 


0.58411 


0.47234 


0.9 


0.37757 


0.30718 


0.8 


0.13510 


0.11362 



TABLE II. Randomness certified by CHSH inequality for dif- 
ferent noises (see text). 

Knowing this property some of the above certificates 
may be improved if an additional condition for CHSH 
inequality is imposed. This can be only done when the 
original certifying operator includes CHSH which is the 
case in (|II.5j) and (|II.8|) . 

In the table Hill certificate III CI (T3C) is compared with 
it's version taking into the account only the maximal vi- 
olation of (|II.5|) attainable for the given amount of noise. 



p 


T3 


T3C 


0.99999 


1.3294 


1.7871 


0.999 


1.2171 


1.4101 


0.95 


0.55873 


0.5931 


0.9 


0.19515 


0.3072 


0.8 





0.1136 



TABLE III. Comparison of min-entropies certified by T3 
(|II.5|I alone and with two additional CHSH conditions (III CI) . 

CHSH inequality has also demonstrated its effective- 
ness for improving certificate III D II (modified CHSH). 
Combining it with a condition (7(1, 2)+C(l, 3)+C(2, 2)- 
C(2,3) > p ■ 2 • y/2 gives the results shown in the table 

ED 



p 


Original HID 11 


Improved III D 1 


0.99999 


1.9764 


1.9764 


0.999 


1.7751 


1.7751 


0.95 


0.7775 


0.78024 


0.9 


0.4365 


0.45443 


0.8 


0.0468 


0.1342 



TABLE IV. Certificate lTTLnl with additional CHSH condition 
compared to the original one. 



requiring less measurement settings. For high noises this 
protocol is very close to III Bl (E with Ei), while not 
requiring to fit parameters for particular p parameter. 
For intermediate amounts of noise it's the best one. 

CHSH appears also in 10[) but in this case imposing 
its violation does not help. We believe that it stems from 
the fact that (|II.10[) and any CHSH operator appearing 
in ti cannot be simultaneously maximally violated. 



IV. RESULTS 

The following results were obtained using the NPA 
method introduced and developed in papers [U [22J. 
This method brings out an infinite hierarchy of condi- 
tions, that is satisfied by any set of quantum correla- 
tions. Each level of this hierarchy may be mapped into 
the semi-definite optimization problem. Such a problem 
may be efficiently solved numerically using the primal- 
dual interior point algorithm [23T - [25j . 

All the results were obtained using level Q2 of the 
NPA hierarchy, only results for Braunstein-Caves in- 
equality for n = 7 was calculated in level Q\+ab due 
to high computer's memory consumption. Since the con- 
ditions of these levels do not contain all the laws of quan- 
tum mechanics, when computing min-entropy we get a 
lower bound of its value, so all of the examined protocols 
may give even more randomness than the presented data 
showsj. In fact each of the levels of the hierarchy corre- 
sponds to some set of polynomial conditions of a finite 
degree. In all the cases we take into account the worst 
case, that is maximize each of the probabilities of given 
output, independently. 



E 




0.75 0.8 0.85 0.9 0.95 1 



P 

FIG. 1. Comparison of lower bounds on min-entropies for 
protocols described in III Al (based on Braunstein-Caves in- 
equalities) as a function of noise. 



This protocol for low noises is almost as efficient as 
III Al (BC3, which is the most efficient in this case), while 



7 In other words, we assume less than quantum mechanics. In 
particular we do not assume no-signaling principle. 
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The results for the protocol lll A[ that uses Braunstein- 
Caves operators, as a function of noise, are shown on the 
figure [T] For all values of noise the simplest operator, 
-BC3 (see III.2I) gives the highest min-entropy. 




0.9999999 
0.999999 
0.99999 
0.9999 
0.999 
0.99 
0.95 
0.9 

0.85 

0.8 



FIG. 2. Lower bound on min-entropy for protocol described 
in III Bl (En with Ei) as a function of </> (see eauation lII.4[l for 
different noises. 



In the figure [2] the results for protocol described in III Bl 
(Eq with Ei) are shown. For parameter (f> equal and 
■| the min-entropy is 0, since then the possible values 
of III. 31 in quantum and classical cases are the same, so 
device's behavior may be implemented classically giving 
no warranty on randomness. An important result is that 
the optimal angle between average values of operators 
III. 31 depends on the noise parameter p. This dependence 
is shown on the table IVl 



p 


<P 


0.9999999 


0.0252 


0.999999 


0.0452 


0.99999 


0.08II 


0.9999 


0.1460 


0.999 


0.2638 


0.99 


0.4562 


0.95 


0.6179 


0.9 


0.6948 


0.85 


0.7357 


0.8 


0.7617 



TABLE V. Optimal angle between En and E\ depending on 
noise. 

The figure [3] shows the results for protocol described 
in III CI (T3C). It is worth to notice that as parameter C 
approaches it maximal value 2 ■ -\/2, then the min-entropy 
tends to 1 (in the case without noise). The min-entropy 
strongly depends on C . This dependence is shown in the 
table ED 

Considering the bound on the value of the operator 
T3 pi. 51 not shown on the figure), it is maximal for C = 




0.999999 
0.99999 



FIG. 3. Lower bound on min-entropy for protocol described 
in lIICI (T3C) as a function of C (see text) for different noises. 



p 


0.999999 


0.99999 


0.9999 


0.999 


c 
p 


2.826 


2.82 


2.8 


2.75 


p 


0.99 


0.95 


0.9 


0.8 


C 
p 


2.6 


2.55 


2.828 


2.828 



TABLE VI. Optimal value of parameter C for protocol III CI 
(T3C) depending on noise. 



2.3094116. For high noises (p < 0.95) min-entropy has 
local minimum near this point. 



modified CHSH 




FIG. 4. Comparison of lower bounds on min-entropies for 
protocols described in HTTJT1 (modified CHSH) and lHD2l 
(other randomly generated protocols) as a function of noise. 



The figure 0] contains the results for protocols using in- 
equalities described in HID II (modified CHSH) and lIID2l 
(other randomly generated operators). 

It can be seen that the protocol III Al using Bell in- 
equality |IL2] (BC3) gives the largest amount of random- 
ness comparing to other described protocols, when the 
noise parameter p is larger than 0.9. Different operators 
from Braunstein-Caves family give less min-entropy for 
all amounts of noise and requires more settings for each 
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partjB 

For high noises (p « 0.8) the largest min-entropy is 
obtained using protocol III Bl (Eq with E\ ) . The main 
disadvantage of this protocol is the necessity to chose 
the angle parameter individually for each noise. 

The certificate [HC] (T3C) shares with [HB] (E with 
Ei) the need for choosing its parameter (in this case C) 
for the given noise. Similarly it gives good results for 
high noises (p ~ 0.8), but not as good as III Bl It also 
requires more measurement settings. 

Using modified CHSH pi D 1[) and certificates I\ and 
I-x (|II D 2j) for smaller noises (p > 0.9), the amount of 
achieved randomness is slightly smaller that the random- 
ness form the protocol BC3 (III Al with Bell inequality 
III.2[) . However, protocol based on modified CHSH in- 
equality requires less measurement settings than BC3. 

Protocols with more complicated Bell inequalities I\ 
and I2 slightly differ depending on the amount of noise. 
For p > 0.999 th e ineq uality h (jIT9]) gives more ran- 
domness than I2 (lILIOj) . while for p < 0.999 I2 gives 
more randomness than I\. 

Comparison of all protocols described in this paper 
may be found in the tables IVIII and IVIIII 



p 


BC 3 


BC 5 


BC 7 


EqE^ 


T3C 


0.99999 


1.9769 


1.9656 


1.9537 


1.7854 


1.7871 


0.999 


1.7792 


1.6841 


1.5917 


1.4013 


1.4101 


0.95 


0.7885 


0.5534 


0.4258 


0.6484 


0.5931 


0.9 


0.4474 


0.2342 


0.1064 


0.4163 


0.3072 


0.8 


0.0709 


0.0000 


0.0000 


0.1461 


0.1136 



a Values for optimal angle parameter. 

TABLE VII. Comparis on of protocols BC3, BC5, BCi ([HA) . 
E E 1 (|HB| and T3C (|HC) for different noises. 



p 


modified CHSH 


h 


h 


0.99999 


1.9764 


1.9753 


1.9742 


0.999 


1.7751 


1.7649 


1.7558 


0.95 


0.78024 


0.7219 


0.7262 


0.9 


0.45443 


0.3625 


0.3959 


0.8 


0.1342 


0.0000 


0.0398 



TABLE VI II. Co mparison of protocols HID II (modified 
CHSH) and III D 21 (7i and I2) for different noises. In the 
column corresponding to modified CHSH we give the result 
for its improved version. 



It is important for a protocol to use not many measurement 
settings, as they require more initial randomness for expansion. 



V. CONCLUSIONS 

In this paper we presented several certificates for ran- 
domness generation protocols. We find that there is no 
unequivocally most efficient one for all the amounts of 
noise. On the other hand some are clearly better than 
the others. 

For low noises (p > 0.92) the most randomness may be 
obtained using the certificate III Al based on Braunstein- 
Caves inequality. This protocol requires 3 binary mea- 
surements for Alice and for Bob and uses only one in- 
equality. 

In the case of intermediate noise (0.85 < p < 0.92) 
the protocol HTT7TI with additional CHSH condition (|Hl|) 
certifies most randomness. It requires 2 binary measure- 
ments for Alice and 3 for Bob. 

Protocol QTB] based on a pair of operators, Eq and E\, 
certifies most randomness among all the compared pro- 
tocols for high noises (p < 0.85). It requires 2 binary 
measurements for both Alice and Bob and has a param- 
eter 4> that has to be chosen for a particular noise p for 
optimal results. 

A comparison of these three protocols is shown on fig- 
ure o 



'E El ' 

modified CHSH 
BC 3 




0.2 til , , , , : 

0.84 0.86 0.88 0.9 0.92 0.94 

P 



FIG. 5. Comparison of three most efficient of investigated 
protocols for 0.84 < p < 0.94. 

The conclusion of this paper is that a honest vendor of 
QRNGs should use one of these three protocols, depend- 
ing on the amount of noise he is expecting the device will 
have to cope with. 

The first interesting fact that our research has revealed 
is that there is no single optimal certificate. But what 
is even more remarkable is that the three best ones fall 
into three distinct categories. Certificate III Al is just a 
Bell operator; HID ll is a combination of two; and Eq 
and Ei are not even Bell inequalities, furthermore they 
have to be considered with different weights. This proves 
that there is more than one place to look for optimal 
certificates and although Bell inequality violation is a 
necessary condition for device independent certification 
of randomness it is not always a good measure of it. 
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